allow writing files to the os tempdir

Author: laverya

pkg/lifecycle/render/dockerlayer/layer.go

@@ -70,7 +70,7 @@ func (u *Unpacker) Execute(
 
 		err = util.IsLegalPath(basePath)
 		if err != nil {
-			return errors.Wrap(err, "write github asset")
+			return errors.Wrap(err, "write docker layer")
 		}
 
 		debug.Log(

pkg/util/legal_path.go

@@ -2,16 +2,28 @@ package util
 
 import (
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 
 	"github.com/pkg/errors"
 )
 
-// IsLegalPath checks if the provided path is a relative path within the current working directory. If it is not, it returns an error.
+// IsLegalPath checks if the provided path is a relative path within the current working directory or within the os tempdir.
+// If it is not, it returns an error.
 func IsLegalPath(path string) error {
 
 	if filepath.IsAbs(path) {
+		relAbsPath, err := filepath.Rel(os.TempDir(), path)
+		if err != nil {
+			return fmt.Errorf("cannot write to an absolute path: %s, got error finding relative path from tempdir: %s", path, err.Error())
+		}
+
+		// subdirectories of the os tempdir are fine
+		if !strings.Contains(relAbsPath, "..") {
+			return nil
+		}
+
 		return fmt.Errorf("cannot write to an absolute path: %s", path)
 	}
 

pkg/util/legal_path_test.go

@@ -1,6 +1,10 @@
 package util
 
-import "testing"
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
 
 func TestIsLegalPath(t *testing.T) {
 	tests := []struct {
@@ -28,6 +32,11 @@ func TestIsLegalPath(t *testing.T) {
 			path:    "./happy/../../../unhappy/path",
 			wantErr: true,
 		},
+		{
+			name:    "absolute path to tempdir",
+			path:    filepath.Join(os.TempDir(), "mydir"),
+			wantErr: false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {